Security and Bug Bounty

Last updated Oct 12, 2026

Starcovery LLC runs its own bug bounty program and pays for security vulnerabilities that are reported under the rules on this page. The program launched on October 12, 2026. Starcovery runs it directly, with no third-party bug bounty platform.

Report a vulnerability

Email sc@starcovery.com. Include:

The affected URL, endpoint, or CLI command.
The steps to reproduce the issue, and a proof of concept when you have one.
The impact: what an attacker can read, change, or do.
Whether you want a cash reward or a Starcovery credit reward.

Starcovery confirms each report by email, tells you whether it is in scope and eligible, and tells you when the fix ships.

Scope

These are in scope:

The website at www.starcovery.com, including signed-in pages and the staff app.
The API, MCP server, OAuth flows, and API keys served from www.starcovery.com.
The starcovery CLI package on npm.

These are out of scope:

Services that Starcovery uses but does not operate, such as its hosting, payment, email, and authentication providers. Report those to the vendor.
Denial of service, load testing, and any test that degrades the service for other users.
Social engineering, phishing, and physical attacks against Starcovery, its staff, its customers, or the creators in its catalog.
Spam and rate limits that only allow more requests than expected, without a security impact.
Missing security headers, cookie flags, or email authentication records, without a working exploit.
Clickjacking on pages with no sensitive action, self-XSS, and logout CSRF.
Reports from automated scanners without a working exploit.
Vulnerabilities in outdated browsers or operating systems.

Rewards

Starcovery pays one reward for each eligible report. You choose the form of the reward:

Cash: $25 to $500, paid through Stripe.
Starcovery credit: $100 to $5,000 in credit, added to the credit ledger of the Starcovery organization you name.

Starcovery sets the amount within each range by the severity and impact of the vulnerability. Severity follows the CVSS 3.1 base score:

Low: 0.1 to 3.9.
Medium: 4.0 to 6.9.
High: 7.0 to 8.9.
Critical: 9.0 to 10.0.

A Low report pays at the bottom of the range, and a Critical report pays at the top. Starcovery makes the final decision on eligibility, severity, and the amount.

Reward terms

Only the first report of a vulnerability is eligible. A duplicate of a report Starcovery already received, or of an issue Starcovery already knows about, is not eligible.
Several reports that share one root cause receive one reward.
Starcovery pays the reward after it confirms the vulnerability.
A credit reward is paid in credits worth five cents each, so $100 is 2,000 credits and $5,000 is 100,000 credits. Reward credits follow the credit terms in the Terms of Use: they never fund a campaign and are not refundable.
You are responsible for any tax on a reward.
Starcovery cannot pay a reward where the law prohibits it, including to a person or country under sanctions.
Employees and contractors of Starcovery, and their immediate family members, are not eligible.
Starcovery can change or end the program at any time. A change does not apply to a report sent before the change was published on this page.

Rules

Test only with accounts and organizations you own. Create a test account for each role you need.
Do not access, change, or delete data that belongs to another user or organization. If you reach such data by accident, stop, do not keep a copy, and report it.
Do not send briefs, proposals, or emails to real creators or customers as part of a test.
Do not run automated scanners at a rate that affects the service.
Do not make a payment with a stolen or another person's card.
Give Starcovery time to fix the issue before you disclose it, and ask before you publish anything about it.
Follow the law that applies to you.

Safe harbor

Starcovery will not take legal action against research that follows the rules on this page and is done in good faith. For such research, Starcovery waives the restriction in the Terms of Use on modifying, disassembling, reverse compiling, or reverse engineering any part of the Site, including the starcovery CLI. If a third party takes legal action against you for such research, Starcovery will make it known that the research was authorized under this program.

Continuous testing

Each Starcovery Asteroid Belt engagement has a written scope that is kept in the repository and changed only through a reviewed pull request. The scope lists the product areas under test, the known gaps that testers exclude, and the behaviors that are intentional. Testing starts automatically on each pull request head after the standard checks pass, and a newer head cancels the run, so the window is the life of that head. Testing runs only against an isolated test environment, never production.

Each run's report and evidence are kept for 14 days. A finding is confirmed by a second pass before it counts. A confirmed finding blocks the merge until it is fixed on the branch or recorded as intended in the scope. Sign-off is the passing findings check together with the merge approval. No individual reviewer is named, and no fixed reporting deadline applies beyond the run itself.

Two kinds of pull request get no run: a pull request that Dependabot opens, and a pull request that changes only documentation or text files.

Testing results as of October 12, 2026

These counts cover every run whose report was still kept on October 12, 2026, which are the runs from October 6 to October 12, 2026.

Runs: 551, on 283 pull request branches.
Runs that finished the findings check: 342. Of these, 116 had no confirmed finding and 226 had at least one.
Confirmed findings: 576. A finding that recurs on several pull requests counts once for each pull request.
Vulnerabilities: 0. No confirmed finding let a caller read or change data beyond its permission, expose a secret, or run injected code.